v0.3.2
This commit is contained in:
Matěj Kubíček
@@ -0,0 +1,219 @@
|
||||
import { createC2pa } from '@contentauth/c2pa-web';
|
||||
import type { Evidence } from '../shared/types';
|
||||
|
||||
const AI_SOURCE_TYPES = [
|
||||
'trainedalgorithmicmedia',
|
||||
'compositewithtrainedalgorithmicmedia',
|
||||
'algorithmicallyenhanced',
|
||||
'algorithmicmedia'
|
||||
];
|
||||
|
||||
interface RecordLike {
|
||||
[key: string]: unknown;
|
||||
}
|
||||
|
||||
let c2paPromise: ReturnType<typeof createC2pa> | undefined;
|
||||
|
||||
/**
|
||||
* c2pa-web 0.14.4 rejects every explicit worker URL whose protocol is not
|
||||
* `https:`, including Firefox's same-extension `moz-extension:` URLs. The
|
||||
* package only reads `protocol` and `toString()` before constructing Worker,
|
||||
* so this adapter lets its HTTPS-only guard validate while Worker still
|
||||
* receives the real, CSP-approved packaged URL. Keep this isolated until the
|
||||
* upstream SDK accepts browser-extension schemes directly.
|
||||
*/
|
||||
export class FirefoxExtensionWorkerUrl extends URL {
|
||||
readonly #packagedUrl: string;
|
||||
|
||||
constructor(packagedUrl: string) {
|
||||
super('https://slopdetect.invalid/c2pa_worker.js');
|
||||
if (!packagedUrl.startsWith('moz-extension:')) {
|
||||
throw new Error('C2PA worker must be a packaged Firefox extension resource.');
|
||||
}
|
||||
this.#packagedUrl = packagedUrl;
|
||||
}
|
||||
|
||||
override toString(): string {
|
||||
return this.#packagedUrl;
|
||||
}
|
||||
}
|
||||
|
||||
async function initialiseC2pa(): ReturnType<typeof createC2pa> {
|
||||
const [trustList, timestampTrustList] = await Promise.all([
|
||||
fetch(browser.runtime.getURL('trust/C2PA-TRUST-LIST.pem')).then((response) => response.text()),
|
||||
fetch(browser.runtime.getURL('trust/C2PA-TSA-TRUST-LIST.pem')).then((response) => response.text())
|
||||
]);
|
||||
return createC2pa({
|
||||
wasmSrc: browser.runtime.getURL('c2pa_bg.wasm'),
|
||||
workerSrc: new FirefoxExtensionWorkerUrl(browser.runtime.getURL('c2pa_worker.js')),
|
||||
settings: {
|
||||
trust: { trustAnchors: `${trustList}\n${timestampTrustList}` },
|
||||
verify: {
|
||||
verifyTrust: true,
|
||||
verifyAfterReading: true,
|
||||
verifyTimestampTrust: true,
|
||||
ocspFetch: false,
|
||||
remoteManifestFetch: false
|
||||
}
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
function getC2pa(): ReturnType<typeof createC2pa> {
|
||||
c2paPromise ??= initialiseC2pa();
|
||||
return c2paPromise;
|
||||
}
|
||||
|
||||
function isRecord(value: unknown): value is RecordLike {
|
||||
return typeof value === 'object' && value !== null && !Array.isArray(value);
|
||||
}
|
||||
|
||||
function walk(value: unknown, visit: (key: string, value: unknown) => void): void {
|
||||
if (Array.isArray(value)) {
|
||||
value.forEach((item) => walk(item, visit));
|
||||
return;
|
||||
}
|
||||
if (!isRecord(value)) return;
|
||||
for (const [key, child] of Object.entries(value)) {
|
||||
visit(key, child);
|
||||
walk(child, visit);
|
||||
}
|
||||
}
|
||||
|
||||
function collectStrings(value: unknown): string[] {
|
||||
const strings: string[] = [];
|
||||
walk(value, (_key, child) => {
|
||||
if (typeof child === 'string') strings.push(child);
|
||||
});
|
||||
return strings;
|
||||
}
|
||||
|
||||
function collectValidationCodes(value: unknown): string[] {
|
||||
const codes = new Set<string>();
|
||||
walk(value, (key, child) => {
|
||||
if (/^(code|status|validation_status|validationStatus)$/i.test(key) && typeof child === 'string') {
|
||||
codes.add(child);
|
||||
}
|
||||
if (/validation_status|validationStatus/i.test(key) && Array.isArray(child)) {
|
||||
for (const entry of child) {
|
||||
if (typeof entry === 'string') codes.add(entry);
|
||||
else if (isRecord(entry) && typeof entry.code === 'string') codes.add(entry.code);
|
||||
}
|
||||
}
|
||||
});
|
||||
return [...codes];
|
||||
}
|
||||
|
||||
function findFirstString(value: unknown, matchingKeys: RegExp): string | undefined {
|
||||
let found: string | undefined;
|
||||
walk(value, (key, child) => {
|
||||
if (!found && matchingKeys.test(key) && typeof child === 'string') found = child;
|
||||
});
|
||||
return found;
|
||||
}
|
||||
|
||||
function hasTrustedCredential(value: unknown): boolean {
|
||||
let trusted = false;
|
||||
walk(value, (key, child) => {
|
||||
if (/trusted/i.test(key) && child === true) trusted = true;
|
||||
if (/validation_state|validationState/i.test(key) && child === 'Trusted') trusted = true;
|
||||
});
|
||||
return trusted;
|
||||
}
|
||||
|
||||
function hasInvalidValidationState(value: unknown): boolean {
|
||||
let invalid = false;
|
||||
walk(value, (key, child) => {
|
||||
if (/validation_state|validationState/i.test(key) && child === 'Invalid') invalid = true;
|
||||
});
|
||||
return invalid;
|
||||
}
|
||||
|
||||
function containsManifest(value: unknown): boolean {
|
||||
if (!isRecord(value)) return false;
|
||||
return Boolean(value.active_manifest || value.activeManifest || value.manifests || value.claims);
|
||||
}
|
||||
|
||||
function isInvalidStatus(code: string): boolean {
|
||||
return /invalid|mismatch|malformed|error|failure|revoked|expired/i.test(code);
|
||||
}
|
||||
|
||||
function serialisable(value: unknown): unknown {
|
||||
try {
|
||||
return JSON.parse(JSON.stringify(value, (_key, item) => (typeof item === 'bigint' ? item.toString() : item)));
|
||||
} catch {
|
||||
return undefined;
|
||||
}
|
||||
}
|
||||
|
||||
function isMissingManifestError(error: unknown): boolean {
|
||||
const message = error instanceof Error ? error.message : String(error);
|
||||
return /manifest.*(?:not found|absent)|jumbf.*not found|no claim|unsupported.*(?:mime|format)/i.test(message);
|
||||
}
|
||||
|
||||
export async function inspectC2pa(blob: Blob, includeRaw: boolean): Promise<Evidence[]> {
|
||||
let reader: Awaited<ReturnType<Awaited<ReturnType<typeof createC2pa>>['reader']['fromBlob']>> | undefined;
|
||||
try {
|
||||
const c2pa = await getC2pa();
|
||||
reader = await c2pa.reader.fromBlob(blob.type || 'application/octet-stream', blob);
|
||||
if (!reader) return [];
|
||||
const store: unknown = await reader.manifestStore();
|
||||
return evidenceFromManifestStore(store, includeRaw);
|
||||
} catch (error) {
|
||||
if (isMissingManifestError(error)) return [];
|
||||
const message = error instanceof Error ? error.message : String(error);
|
||||
return [{
|
||||
id: crypto.randomUUID(),
|
||||
kind: 'limitation',
|
||||
strength: 'none',
|
||||
verdict: 'unknown',
|
||||
title: 'C2PA inspection failed',
|
||||
detail: message.slice(0, 300),
|
||||
detector: '@contentauth/c2pa-web'
|
||||
}];
|
||||
} finally {
|
||||
await reader?.free();
|
||||
}
|
||||
}
|
||||
|
||||
export function evidenceFromManifestStore(store: unknown, includeRaw: boolean): Evidence[] {
|
||||
if (!containsManifest(store)) return [];
|
||||
|
||||
const strings = collectStrings(store);
|
||||
const aiGenerated = strings.some((value) => {
|
||||
const normalised = value.toLowerCase().replace(/[^a-z]/g, '');
|
||||
return AI_SOURCE_TYPES.some((type) => normalised.includes(type));
|
||||
});
|
||||
const statuses = collectValidationCodes(store);
|
||||
const invalid = hasInvalidValidationState(store) || statuses.some(isInvalidStatus);
|
||||
const trusted = hasTrustedCredential(store);
|
||||
const issuer = findFirstString(store, /issuer|common_name|organization|signer/i);
|
||||
|
||||
if (invalid) {
|
||||
return [{
|
||||
id: crypto.randomUUID(),
|
||||
kind: 'c2pa',
|
||||
strength: 'invalid',
|
||||
verdict: 'invalid',
|
||||
title: 'Invalid Content Credential',
|
||||
detail: `C2PA provenance was present but validation reported: ${statuses.join(', ') || 'an integrity error'}.`,
|
||||
detector: '@contentauth/c2pa-web',
|
||||
issuer,
|
||||
raw: includeRaw ? serialisable(store) : undefined
|
||||
}];
|
||||
}
|
||||
|
||||
return [{
|
||||
id: crypto.randomUUID(),
|
||||
kind: 'c2pa',
|
||||
strength: trusted ? 'verified' : 'detected',
|
||||
verdict: aiGenerated ? 'ai' : 'not-ai-asserted',
|
||||
title: aiGenerated ? 'AI provenance credential' : 'Content Credential',
|
||||
detail: aiGenerated
|
||||
? `A ${trusted ? 'trusted and valid' : 'readable but not trusted'} C2PA claim identifies AI generation or manipulation.`
|
||||
: `A ${trusted ? 'trusted and valid' : 'readable but not trusted'} C2PA claim was found without an AI-generation assertion.`,
|
||||
detector: '@contentauth/c2pa-web',
|
||||
issuer,
|
||||
raw: includeRaw ? serialisable(store) : undefined
|
||||
}];
|
||||
}
|
||||
Reference in New Issue
Block a user